54ch10-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| BRIEF_API_KEY | No | Optional paid key. Empty — wrapper sends X-54ch10-Free: 1 | |
| BRIEF_API_BASE | No | Override API base (default https://54ch10.uk) | https://54ch10.uk |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| prompts | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| url.openA | Maps to GET /v1/open for URL checks (page_risk, whois, page). Score 0–100, lower is better. HTTP 402 when unpaid — prefer X-54ch10-Stack or Bearer 54k_ via BRIEF_API_KEY. For type=url calls /v1/open?q=; for address|token keeps GET /v1/brief?type=&q=. Call first for wrap-before-click; then domain.whois / domain.dns / domain.tls. Analytics-only. |
| url.open_batchA | POST /v1/open/batch with JSON {urls:[...]}. Paid-only (stack X-54ch10-Stack or Bearer 54k_); no free path — HTTP 402 without credits. Cap 25 URLs per request. Server concurrency ~3; global inflight ~10. Prefer for allowlists; human bulk UI: https://linksafu.com/bulk. Each URL gets the same page_risk brief as GET /v1/open. Analytics-only. |
| url.fetchA | Page extraction / public URL to markdown. GET https://54ch10.uk/v1/fetch?url= at $0.005. SSRF-safe; returns status, contentType, markdown|text (200KB cap). Use after url.open when you need page body, not just risk signals. Analytics-only. |
| url.normalizeA | GET /v1/normalize-url — canonicalize a URL (scheme/host lowercased, fragment stripped, query sorted) before comparing or opening. Call before url.open when the URL is messy or duplicated. Analytics-only. |
| domain.whoisA | GET /v1/whois — look up domain WHOIS/RDAP (registration, registrar, age_days, status, nameservers). Call after url.open when you need registration age / registrar signals. Analytics-only — not clearance. |
| domain.dnsA | GET /v1/dns — summarize DNS A/AAAA/MX/NS for a domain with fraud-signal style flags. Call with domain.whois / domain.tls for full domain hygiene after url.open. Analytics-only. |
| domain.tlsA | GET /v1/tls — summarize TLS/CT (issuer, validity, HTTPS reachability) via crt.sh + probe. Call after url.open / domain.dns when certificate age or issuer matters. Analytics-only. |
| util.hashA | GET /v1/hash — hash UTF-8 text (sha256|sha1|md5) to hex + base64. Utility for fingerprints — not crypto advice. Analytics-only utility. |
| util.encodeA | GET /v1/encode — encode text as base64, hex, or url-encoding. Utility for safe transport of strings between tools. |
| paste.writeA | POST /v1/paste — store a short ephemeral paste (KV TTL default 1h, max 24h) and return an id. Agent handoff only — not a vault. Pair with paste.read. |
| paste.readA | GET /v1/paste — retrieve an ephemeral paste by id from paste.write before TTL expiry. Agent handoff only — not a vault. |
| briefA | Legacy alias for url.open. Prefer url.open. type=url → GET /v1/open; address|token → GET /v1/brief. Score lower is better. HTTP 402 unpaid — stack or Bearer 54k_. |
| whoisA | Legacy alias for domain.whois (GET /v1/whois). Prefer domain.whois. |
| dnsA | Legacy alias for domain.dns (GET /v1/dns). Prefer domain.dns. |
| tlsA | Legacy alias for domain.tls (GET /v1/tls). Prefer domain.tls. |
| normalize-urlA | Legacy alias for url.normalize (GET /v1/normalize-url). Prefer url.normalize. |
| fetchA | Legacy alias for url.fetch. Page extraction: GET https://54ch10.uk/v1/fetch?url= at $0.005. Prefer url.fetch. |
| hashA | Legacy alias for util.hash (GET /v1/hash). Prefer util.hash. |
| encodeC | Legacy alias for util.encode (GET /v1/encode). Prefer util.encode. |
| paste_writeA | Legacy alias for paste.write (POST /v1/paste). Prefer paste.write. |
| paste_readA | Legacy alias for paste.read (GET /v1/paste). Prefer paste.read. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
| wrap_before_click | Pre-interact workflow via GET /v1/open (url.open type=url), then domain whois/dns/tls, optionally fetch page body. Prefer stack (X-54ch10-Stack) or Bearer 54k_ for paid. Use before trusting or clicking a link. |
| domain_hygiene | Run whois + dns + tls for a domain after a URL open (/v1/open). Analytics-only domain hygiene. |
| free_taste_demo | Walk through the free demo scam-signals page, then wrap-before-click with url.open (/v1/open) / domain.*. Mentions stack purchase path. |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 21 tools
The set includes ten legacy aliases that duplicate primary tools exactly (brief vs url.open, whois vs domain.whois, etc.), so many tools effectively do the same thing. Even though descriptions label the aliases, an agent must choose between redundant names.
Primary tools use a clean resource.action style (url.open, domain.whois, paste.read), but this is mixed with url.open_batch, bare legacy names like brief and dns, and hyphenated normalize-url. The naming is not chaotic but it is inconsistent across the full tool set.
21 tools is borderline heavy, and roughly half are legacy duplicates of the primary 11 tools. The unique surface is reasonable, but exposing aliases as separate tools inflates the count.
The toolset covers the core URL risk workflow: normalize, open/batch, fetch, plus domain enrichment (whois/dns/tls) and small utilities. Minor gaps like no explicit domain reputation endpoint or batch result retrieval can be worked around.